dsh-one-gateway

Configuration

Only the exact fields shown below are accepted. Unknown keys are errors. There are no listenHost, listenPort, upstream, headerName, jwksUrl, allowAnonymous, trustPrivateNetwork, public, or funnel keys.

Tailscale — trusted-header means Serve injects the login; routeManagement: ensure means setup will create one missing private Serve route:

enabled: true
externalOrigin: 'https://gateway.example-tailnet.ts.net:8443'
provider:
  type: tailscale-serve
  routeManagement: ensure
auth:
  mode: trusted-header
  trustedPrincipals:
    - 'login:operator@example.invalid'

Headscale TCP Serve — gateway-credential means possession of a generated secret; TCP Serve is private reachability only. tls is required:

enabled: true
externalOrigin: 'https://gateway.example.invalid:8443'
provider:
  type: headscale-tcp-serve
  routeManagement: ensure
tls:
  certPath: '/path/to/dsh-one-gateway/cert.pem'
  keyPath: '/path/to/dsh-one-gateway/key.pem'
auth:
  mode: gateway-credential
  trustedPrincipals:
    - 'credential:operator-1'
  credentialStorePath: '/path/to/dsh-one-gateway/credentials.json'

Cloudflare — signed-jwt means the gateway locally validates the Access identity JWT; routeManagement: verify-only means you attach Access yourself:

enabled: true
externalOrigin: 'https://dsh.example.invalid'
provider:
  type: cloudflare-access
  routeManagement: verify-only
  teamOrigin: 'https://team.example.invalid'
  applicationAudience: 'replace-with-access-application-audience'
auth:
  mode: signed-jwt
  trustedPrincipals:
    - 'email:operator@example.invalid'